Google Chrome CVE-2026-78892

Exploitation requires physical or logical local access to a Windows system running Google Chrome prior to 152.0.7977.65, with the Chromoting (Chrome Remote Desktop) host component installed and active - Chrome Remote Desktop is not installed by default in standard Chrome installations and must be explicitly configured by users or administrators. The CVSS vector confirms PR:L, meaning a standard authenticated local user account (not anonymous or unauthenticated access) is the minimum requirement. No victim user interaction is required (UI:N). Exploitation is strictly limited to the Windows platform; macOS and Linux Chrome installations are not affected. The requirement for a non-default Chrome Remote Desktop deployment and local session access meaningfully limits the exposed population compared to the raw CVSS score might imply.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N characterizes this as a high-impact but locally-constrained vulnerability: low attack complexity, no user interaction, and no scope change, but requiring an authenticated local session with at minimum a standard user account. The 7.1 base score reflects the genuine severity of the authorization bypass if exploited, yet the EPSS score of 0.11% at the 1st percentile is strikingly low for a score in this range, indicating no observed exploitation pressure in the wild and suggesting the local access requirement substantially limits attacker opportunity. There is no CISA KEV listing and no public POC code has been identified, consistent with the low EPSS. The CVSS signals and EPSS signals are not conflicting - they are complementary: this is a real, high-impact flaw that is currently of low exploitation interest, most likely due to the prerequisite of local system access. The practical threat is highest in shared Windows environments, Citrix/RDS deployments, or enterprise managed devices where multiple users or automated processes run under low-privilege accounts and have Chrome Remote Desktop available. No data conflicts were identified; the local vector in CVSS is consistent with the description's 'local attacker via a local program' framing.

A local attacker with a standard Windows user account on a system running Chrome prior to 152.0.7977.65 executes a specially crafted local program that sends malformed or unauthorized authorization requests to the Chromoting component. The flawed authorization check fails to correctly reject the request, granting the attacker access to system resources or configurations beyond their privilege level - for example, reading sensitive session data or modifying Chrome Remote Desktop settings reserved for elevated users. No public exploit code has been identified at time of analysis; however, the low attack complexity (AC:L) suggests that once the authorization flaw is understood, exploitation would not require sophisticated techniques.